23d07d7710a7865707208fa409dbb8455cb22ac9be82b936ab223f4ad3dd4ab7

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf8b2ed6102580ed3248ae3650895000N.exe
Size

468KB
MD5

cf8b2ed6102580ed3248ae3650895000
SHA1

7495e40348c05299d4a300a9cb18416b9098f5dd
SHA256

23d07d7710a7865707208fa409dbb8455cb22ac9be82b936ab223f4ad3dd4ab7
SHA512

054bbb4579c4ad0019928109b40a8c958e7d46c541fa6ecd874a44ab17aeb2caec5e1f47dfd5038c5cbe84a266306cd94e6a9cfd120a19aa04016a74ee7e6f50
SSDEEP

3072:abvfog5+Pb8UwaYhPzijTf8/EChAZ4pfhdHMZVrZVLWNyrLT0ayE:abnohYUwpPejTf/EI5VLq0LT0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3120	Unicorn-55419.exe
4372	Unicorn-42166.exe
4528	Unicorn-22108.exe
3000	Unicorn-31801.exe
2264	Unicorn-10211.exe
2268	Unicorn-62013.exe
1212	Unicorn-43580.exe
3692	Unicorn-29430.exe
1484	Unicorn-29430.exe
2968	Unicorn-42599.exe
2476	Unicorn-48464.exe
4120	Unicorn-28863.exe
1160	Unicorn-48729.exe
944	Unicorn-38491.exe
2156	Unicorn-37156.exe
4924	Unicorn-54329.exe
3556	Unicorn-38870.exe
3288	Unicorn-39638.exe
4264	Unicorn-19772.exe
4640	Unicorn-32927.exe
1808	Unicorn-63867.exe
4384	Unicorn-63867.exe
116	Unicorn-53104.exe
208	Unicorn-35620.exe
4020	Unicorn-24153.exe
320	Unicorn-48471.exe
2036	Unicorn-44633.exe
3960	Unicorn-2785.exe
4016	Unicorn-22651.exe
2340	Unicorn-62157.exe
3608	Unicorn-63111.exe
616	Unicorn-57046.exe
4540	Unicorn-52962.exe
4364	Unicorn-47638.exe
4840	Unicorn-30041.exe
3876	Unicorn-30041.exe
4628	Unicorn-25468.exe
1072	Unicorn-6147.exe
2852	Unicorn-6147.exe
3484	Unicorn-33113.exe
448	Unicorn-824.exe
3352	Unicorn-824.exe
3248	Unicorn-54498.exe
900	Unicorn-8826.exe
5060	Unicorn-61213.exe
2392	Unicorn-61213.exe
3596	Unicorn-44000.exe
5036	Unicorn-6111.exe
2560	Unicorn-22646.exe
4608	Unicorn-31312.exe
2496	Unicorn-50041.exe
212	Unicorn-11622.exe
4852	Unicorn-17753.exe
2440	Unicorn-47965.exe
648	Unicorn-15676.exe
4184	Unicorn-26611.exe
2772	Unicorn-16217.exe
1496	Unicorn-492.exe
3928	Unicorn-36886.exe
3036	Unicorn-64960.exe
4260	Unicorn-59382.exe
2064	Unicorn-47497.exe
1744	Unicorn-13912.exe
4768	Unicorn-64950.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
9168	6060	WerFault.exe	202
13264	8332	WerFault.exe	354

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16559.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34946.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40799.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24088.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38303.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64960.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16568	dwm.exe
Token: SeChangeNotifyPrivilege	16568	dwm.exe
Token: 33	16568	dwm.exe
Token: SeIncBasePriorityPrivilege	16568	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2972	cf8b2ed6102580ed3248ae3650895000N.exe
3120	Unicorn-55419.exe
4372	Unicorn-42166.exe
4528	Unicorn-22108.exe
2268	Unicorn-62013.exe
2264	Unicorn-10211.exe
3000	Unicorn-31801.exe
1212	Unicorn-43580.exe
3692	Unicorn-29430.exe
1484	Unicorn-29430.exe
1160	Unicorn-48729.exe
2476	Unicorn-48464.exe
4120	Unicorn-28863.exe
2968	Unicorn-42599.exe
944	Unicorn-38491.exe
2156	Unicorn-37156.exe
4924	Unicorn-54329.exe
3288	Unicorn-39638.exe
3556	Unicorn-38870.exe
4640	Unicorn-32927.exe
4264	Unicorn-19772.exe
4020	Unicorn-24153.exe
1808	Unicorn-63867.exe
320	Unicorn-48471.exe
4384	Unicorn-63867.exe
208	Unicorn-35620.exe
116	Unicorn-53104.exe
3960	Unicorn-2785.exe
4016	Unicorn-22651.exe
2036	Unicorn-44633.exe
2340	Unicorn-62157.exe
3608	Unicorn-63111.exe
616	Unicorn-57046.exe
4540	Unicorn-52962.exe
4364	Unicorn-47638.exe
4840	Unicorn-30041.exe
3876	Unicorn-30041.exe
4628	Unicorn-25468.exe
1072	Unicorn-6147.exe
2852	Unicorn-6147.exe
3484	Unicorn-33113.exe
3248	Unicorn-54498.exe
3352	Unicorn-824.exe
900	Unicorn-8826.exe
448	Unicorn-824.exe
5060	Unicorn-61213.exe
2392	Unicorn-61213.exe
2560	Unicorn-22646.exe
5036	Unicorn-6111.exe
3596	Unicorn-44000.exe
4608	Unicorn-31312.exe
2496	Unicorn-50041.exe
2440	Unicorn-47965.exe
4852	Unicorn-17753.exe
212	Unicorn-11622.exe
4184	Unicorn-26611.exe
648	Unicorn-15676.exe
1496	Unicorn-492.exe
2772	Unicorn-16217.exe
3036	Unicorn-64960.exe
3928	Unicorn-36886.exe
4260	Unicorn-59382.exe
2064	Unicorn-47497.exe
1744	Unicorn-13912.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3120	2972	cf8b2ed6102580ed3248ae3650895000N.exe	90
PID 2972 wrote to memory of 3120	2972	cf8b2ed6102580ed3248ae3650895000N.exe	90
PID 2972 wrote to memory of 3120	2972	cf8b2ed6102580ed3248ae3650895000N.exe	90
PID 3120 wrote to memory of 4372	3120	Unicorn-55419.exe	93
PID 3120 wrote to memory of 4372	3120	Unicorn-55419.exe	93
PID 3120 wrote to memory of 4372	3120	Unicorn-55419.exe	93
PID 2972 wrote to memory of 4528	2972	cf8b2ed6102580ed3248ae3650895000N.exe	94
PID 2972 wrote to memory of 4528	2972	cf8b2ed6102580ed3248ae3650895000N.exe	94
PID 2972 wrote to memory of 4528	2972	cf8b2ed6102580ed3248ae3650895000N.exe	94
PID 4528 wrote to memory of 3000	4528	Unicorn-22108.exe	97
PID 4528 wrote to memory of 3000	4528	Unicorn-22108.exe	97
PID 4528 wrote to memory of 3000	4528	Unicorn-22108.exe	97
PID 3120 wrote to memory of 2268	3120	Unicorn-55419.exe	99
PID 3120 wrote to memory of 2268	3120	Unicorn-55419.exe	99
PID 3120 wrote to memory of 2268	3120	Unicorn-55419.exe	99
PID 2972 wrote to memory of 2264	2972	cf8b2ed6102580ed3248ae3650895000N.exe	98
PID 2972 wrote to memory of 2264	2972	cf8b2ed6102580ed3248ae3650895000N.exe	98
PID 2972 wrote to memory of 2264	2972	cf8b2ed6102580ed3248ae3650895000N.exe	98
PID 4372 wrote to memory of 1212	4372	Unicorn-42166.exe	100
PID 4372 wrote to memory of 1212	4372	Unicorn-42166.exe	100
PID 4372 wrote to memory of 1212	4372	Unicorn-42166.exe	100
PID 3000 wrote to memory of 1484	3000	Unicorn-31801.exe	101
PID 3000 wrote to memory of 1484	3000	Unicorn-31801.exe	101
PID 2264 wrote to memory of 3692	2264	Unicorn-10211.exe	102
PID 3000 wrote to memory of 1484	3000	Unicorn-31801.exe	101
PID 2264 wrote to memory of 3692	2264	Unicorn-10211.exe	102
PID 2264 wrote to memory of 3692	2264	Unicorn-10211.exe	102
PID 3120 wrote to memory of 2968	3120	Unicorn-55419.exe	103
PID 3120 wrote to memory of 2968	3120	Unicorn-55419.exe	103
PID 3120 wrote to memory of 2968	3120	Unicorn-55419.exe	103
PID 2972 wrote to memory of 2476	2972	cf8b2ed6102580ed3248ae3650895000N.exe	105
PID 2972 wrote to memory of 2476	2972	cf8b2ed6102580ed3248ae3650895000N.exe	105
PID 2972 wrote to memory of 2476	2972	cf8b2ed6102580ed3248ae3650895000N.exe	105
PID 4528 wrote to memory of 4120	4528	Unicorn-22108.exe	104
PID 4528 wrote to memory of 4120	4528	Unicorn-22108.exe	104
PID 4528 wrote to memory of 4120	4528	Unicorn-22108.exe	104
PID 2268 wrote to memory of 1160	2268	Unicorn-62013.exe	106
PID 2268 wrote to memory of 1160	2268	Unicorn-62013.exe	106
PID 2268 wrote to memory of 1160	2268	Unicorn-62013.exe	106
PID 1212 wrote to memory of 944	1212	Unicorn-43580.exe	107
PID 1212 wrote to memory of 944	1212	Unicorn-43580.exe	107
PID 1212 wrote to memory of 944	1212	Unicorn-43580.exe	107
PID 4372 wrote to memory of 2156	4372	Unicorn-42166.exe	108
PID 4372 wrote to memory of 2156	4372	Unicorn-42166.exe	108
PID 4372 wrote to memory of 2156	4372	Unicorn-42166.exe	108
PID 1484 wrote to memory of 4924	1484	Unicorn-29430.exe	109
PID 1484 wrote to memory of 4924	1484	Unicorn-29430.exe	109
PID 1484 wrote to memory of 4924	1484	Unicorn-29430.exe	109
PID 3692 wrote to memory of 3556	3692	Unicorn-29430.exe	110
PID 3692 wrote to memory of 3556	3692	Unicorn-29430.exe	110
PID 3692 wrote to memory of 3556	3692	Unicorn-29430.exe	110
PID 2264 wrote to memory of 4264	2264	Unicorn-10211.exe	111
PID 2264 wrote to memory of 4264	2264	Unicorn-10211.exe	111
PID 2264 wrote to memory of 4264	2264	Unicorn-10211.exe	111
PID 1160 wrote to memory of 3288	1160	Unicorn-48729.exe	112
PID 1160 wrote to memory of 3288	1160	Unicorn-48729.exe	112
PID 1160 wrote to memory of 3288	1160	Unicorn-48729.exe	112
PID 2268 wrote to memory of 4640	2268	Unicorn-62013.exe	113
PID 2268 wrote to memory of 4640	2268	Unicorn-62013.exe	113
PID 2268 wrote to memory of 4640	2268	Unicorn-62013.exe	113
PID 4120 wrote to memory of 1808	4120	Unicorn-28863.exe	114
PID 4120 wrote to memory of 1808	4120	Unicorn-28863.exe	114
PID 4120 wrote to memory of 1808	4120	Unicorn-28863.exe	114
PID 2968 wrote to memory of 4384	2968	Unicorn-42599.exe	115

C:\Users\Admin\AppData\Local\Temp\cf8b2ed6102580ed3248ae3650895000N.exe
"C:\Users\Admin\AppData\Local\Temp\cf8b2ed6102580ed3248ae3650895000N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55419.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55419.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44633.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37817.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
        9⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        8⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52944.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        7⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        9⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        9⤵
        
        PID:16756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53600.exe
        8⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18798.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        7⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33054.exe
        7⤵
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38341.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        8⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11998.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28143.exe
        7⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        6⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50041.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15477.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        9⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        10⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        10⤵
        
        PID:18208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        9⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        9⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15004.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        8⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
        8⤵
        
        PID:18104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55263.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
        8⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        8⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        7⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60406.exe
        7⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47968.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
        8⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        8⤵
        
        PID:17780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        7⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36420.exe
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60912.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49590.exe
        6⤵
        
        PID:17512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-952.exe
        6⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        8⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        8⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8319.exe
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63576.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10563.exe
        6⤵
        
        PID:12588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10604.exe
        5⤵
        
        PID:6060
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 636
        6⤵
        Program crash
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44279.exe
        5⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49214.exe
        6⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39743.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        8⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        9⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24517.exe
        9⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        8⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        8⤵
        
        PID:18200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        8⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53247.exe
        8⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        7⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        7⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46624.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        8⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18437.exe
        8⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25407.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38154.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35640.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4487.exe
        7⤵
        
        PID:16080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64084.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47965.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8055.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        8⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        8⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12363.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39780.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2627.exe
        5⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        7⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24325.exe
        6⤵
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27501.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52372.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12551.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30232.exe
        7⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44477.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37711.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32926.exe
        5⤵
        
        PID:17828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38127.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24542.exe
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        5⤵
        
        PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31039.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23513.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21633.exe
        6⤵
        
        PID:17720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46889.exe
        5⤵
        
        PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35278.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11199.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39638.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60024.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        9⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        10⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21991.exe
        10⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26044.exe
        9⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41103.exe
        9⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19519.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        9⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5862.exe
        8⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10993.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60032.exe
        7⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
        7⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        7⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20191.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54595.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13573.exe
        8⤵
        
        PID:18264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
        7⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23046.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7663.exe
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2485.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23830.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39417.exe
        7⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12375.exe
        9⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        9⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        8⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        8⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        7⤵
        
        PID:16532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26297.exe
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        7⤵
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28293.exe
        6⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        7⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38303.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44425.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56537.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26766.exe
        7⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20489.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        6⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55149.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12536.exe
        6⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26785.exe
        5⤵
        
        PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13912.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19225.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31510.exe
        9⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        9⤵
        
        PID:17884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8319.exe
        8⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18007.exe
        8⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        7⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44856.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18108.exe
        6⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29304.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        8⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        6⤵
        
        PID:18076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12604.exe
        5⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32318.exe
        8⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
        7⤵
        
        PID:12064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        7⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12254.exe
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        7⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        7⤵
        
        PID:17928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52111.exe
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15279.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        5⤵
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20231.exe
        5⤵
        
        PID:17400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62454.exe
        5⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1109.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57663.exe
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42079.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        7⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22238.exe
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39288.exe
        6⤵
        
        PID:17700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54646.exe
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        7⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        7⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27278.exe
        7⤵
        
        PID:18256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44477.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19973.exe
        6⤵
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        5⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19329.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
        5⤵
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40560.exe
      4⤵
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        6⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        7⤵
        
        PID:13236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59936.exe
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        5⤵
        
        PID:13576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3710.exe
        5⤵
        
        PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45396.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15078.exe
        5⤵
        
        PID:13256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63890.exe
        5⤵
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
      4⤵
      PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53862.exe
      4⤵
      PID:11596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
      4⤵
      PID:17576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        8⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        8⤵
        
        PID:17364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
        7⤵
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21702.exe
        6⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28545.exe
        7⤵
        
        PID:17736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55629.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9563.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3032.exe
        6⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        7⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12910.exe
        7⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46013.exe
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29774.exe
        6⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20609.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50555.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        6⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        7⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        7⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45880.exe
        6⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25756.exe
        5⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        6⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        5⤵
        
        PID:15684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58055.exe
      4⤵
      PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42367.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        6⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1798.exe
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exe
        5⤵
        
        PID:16288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
      4⤵
      PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21342.exe
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16019.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16702.exe
      4⤵
      PID:16264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
      4⤵
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4568.exe
        6⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22480.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        6⤵
        
        PID:2504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30725.exe
        6⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        5⤵
        
        PID:8332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8332 -s 632
        6⤵
        Program crash
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38712.exe
        5⤵
        
        PID:17532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30457.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17503.exe
        5⤵
        
        PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
      4⤵
      PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53.exe
        5⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        6⤵
        
        PID:18232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        5⤵
        
        PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27292.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        5⤵
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7366.exe
      4⤵
      PID:10948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39858.exe
      4⤵
      PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6047.exe
    3⤵
    PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60185.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45244.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        6⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
      4⤵
      PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        5⤵
        
        PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5192.exe
    3⤵
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exe
      4⤵
      PID:9492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
      4⤵
      PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50319.exe
      4⤵
      PID:15936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15342.exe
    3⤵
    PID:9400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
    3⤵
    PID:14288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8129.exe
    3⤵
    PID:17232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36886.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        9⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        10⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        10⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        9⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        9⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
        8⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2042.exe
        9⤵
        
        PID:17804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46320.exe
        8⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        8⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47609.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58744.exe
        9⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50560.exe
        9⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        8⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48479.exe
        8⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64743.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34329.exe
        8⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        8⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43631.exe
        7⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        7⤵
        
        PID:18248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64960.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23833.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1464.exe
        9⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42114.exe
        9⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52198.exe
        9⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        7⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        7⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52534.exe
        7⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47989.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37886.exe
        8⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33832.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33837.exe
        6⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29313.exe
        7⤵
        
        PID:16448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2878.exe
        6⤵
        
        PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59382.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23672.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        8⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        9⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37176.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29126.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32086.exe
        8⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        8⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9343.exe
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        8⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50232.exe
        8⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12142.exe
        7⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44877.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        6⤵
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47497.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29401.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33726.exe
        8⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49871.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43576.exe
        7⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26078.exe
        6⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        7⤵
        
        PID:15692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        6⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        6⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        7⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24030.exe
        6⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19676.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16217.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        8⤵
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12567.exe
        7⤵
        
        PID:16784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        6⤵
        
        PID:17600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37983.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2072.exe
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63030.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65375.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44006.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        5⤵
        
        PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-184.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56696.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        7⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
        7⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33064.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18398.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        5⤵
        
        PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17398.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        5⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35201.exe
        6⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        5⤵
        
        PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2300.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
      4⤵
      PID:12456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-824.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        6⤵
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51576.exe
        7⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49260.exe
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28894.exe
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        7⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        7⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
        7⤵
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56184.exe
        6⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38940.exe
        5⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32344.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-728.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        8⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19775.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26821.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1055.exe
        6⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        7⤵
        
        PID:17812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29615.exe
        6⤵
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44816.exe
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61640.exe
        5⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        5⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        6⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        7⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52265.exe
        7⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15749.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41206.exe
        6⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27100.exe
        5⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25733.exe
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31070.exe
        5⤵
        
        PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23557.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16767.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60815.exe
        5⤵
        
        PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      4⤵
      PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36583.exe
        5⤵
        
        PID:15820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
      4⤵
      PID:12732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29617.exe
      4⤵
      PID:17300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24598.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62425.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        8⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23646.exe
        8⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1347.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48914.exe
        7⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16559.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10439.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42104.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5183.exe
        6⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9059.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45552.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20949.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55416.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        6⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        7⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5247.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        6⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23359.exe
        5⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        6⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45432.exe
        5⤵
        
        PID:17332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40135.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        5⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        5⤵
        
        PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
      4⤵
      PID:9776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7943.exe
      4⤵
      PID:18224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57078.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22277.exe
        6⤵
        
        PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13724.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30350.exe
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57376.exe
      4⤵
      PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2115.exe
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8535.exe
      4⤵
      PID:18096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55255.exe
    3⤵
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
        5⤵
        
        PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57696.exe
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
      4⤵
      PID:13992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30140.exe
    3⤵
    PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27353.exe
      4⤵
      PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54664.exe
      4⤵
      PID:2792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
    3⤵
    PID:10936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2966.exe
    3⤵
    PID:15584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19111.exe
        8⤵
        
        PID:17564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5084.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5230.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3710.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        5⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54009.exe
        6⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2014.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60623.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64344.exe
        7⤵
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41916.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        6⤵
        
        PID:17756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50552.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31318.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8478.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25276.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32078.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31855.exe
        5⤵
        
        PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25468.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64950.exe
        5⤵
        Executes dropped EXE
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4149.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12085.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        8⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        7⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33343.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        6⤵
        
        PID:17452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31071.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5816.exe
        7⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18151.exe
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11526.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        5⤵
        
        PID:17428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15587.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
        5⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4312.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43366.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32687.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        5⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
      4⤵
      PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32383.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54886.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46968.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
      4⤵
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8534.exe
      4⤵
      PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        6⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56707.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        7⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8511.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32632.exe
        6⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
        5⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41537.exe
        6⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64944.exe
        5⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28286.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40249.exe
        5⤵
        
        PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42588.exe
      4⤵
      PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        6⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6616.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54591.exe
        7⤵
        
        PID:16252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        6⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14021.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        5⤵
        
        PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63826.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        5⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12760.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50632.exe
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20543.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36614.exe
        5⤵
        
        PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48751.exe
      4⤵
      PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56894.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
      4⤵
      PID:16436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6147.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30742.exe
      4⤵
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
        6⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38951.exe
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        5⤵
        
        PID:14216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16917.exe
        5⤵
        
        PID:17476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57216.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1911.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58966.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39100.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2213.exe
        5⤵
        
        PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2319.exe
      4⤵
      PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55350.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12894.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28438.exe
      4⤵
      PID:13712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
      4⤵
      PID:17900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55277.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
      4⤵
      PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        5⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46585.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        6⤵
        
        PID:16628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        5⤵
        
        PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
      4⤵
      PID:13584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
      4⤵
      PID:1664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7414.exe
    3⤵
    PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28409.exe
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14814.exe
      4⤵
      PID:11640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39209.exe
      4⤵
      PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50048.exe
    3⤵
    PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42632.exe
    3⤵
    PID:12488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18480.exe
    3⤵
    PID:16400
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
      4⤵
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
        5⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21211.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40799.exe
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        6⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        5⤵
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48146.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5414.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54838.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30270.exe
        6⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6620.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        5⤵
        
        PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48912.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56279.exe
      4⤵
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
      4⤵
      PID:16420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64473.exe
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57664.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64367.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57120.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35640.exe
        5⤵
        
        PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35740.exe
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
      4⤵
      PID:11084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52367.exe
      4⤵
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36089.exe
      4⤵
      PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35126.exe
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49407.exe
        5⤵
        
        PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22213.exe
      4⤵
      PID:17460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17391.exe
    3⤵
    PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
      4⤵
      PID:13968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
      4⤵
      PID:18084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21119.exe
    3⤵
    PID:12744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40011.exe
    3⤵
    PID:17436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36065.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57600.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27065.exe
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4326.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64399.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
      4⤵
      PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56132.exe
      4⤵
      PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16142.exe
      4⤵
      PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58384.exe
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
      4⤵
      PID:13980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54758.exe
      4⤵
      PID:1116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
    3⤵
    PID:9568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
    3⤵
    PID:14192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27505.exe
    3⤵
    PID:17092
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6111.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37734.exe
    3⤵
    PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5336.exe
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30085.exe
        5⤵
        
        PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40943.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1222.exe
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
      4⤵
      PID:5044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5574.exe
    3⤵
    PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6484.exe
      4⤵
      PID:14340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5982.exe
      4⤵
      PID:17592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7980.exe
    3⤵
    PID:12448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
    3⤵
    PID:18068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40326.exe
  2⤵
  PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60377.exe
    3⤵
    PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24920.exe
      4⤵
      PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14872.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54472.exe
        5⤵
        
        PID:17892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25951.exe
      4⤵
      PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6702.exe
      4⤵
      PID:15464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
    3⤵
    PID:9500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33144.exe
    3⤵
    PID:5812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37963.exe
  2⤵
  PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39990.exe
    3⤵
    PID:10220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21346.exe
    3⤵
    PID:14168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23749.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1559.exe
  2⤵
  PID:10168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61091.exe
  2⤵
  PID:14980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40144.exe
  2⤵
  PID:18240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6060 -ip 6060
1⤵
PID:7960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 8332 -ip 8332
1⤵
PID:14168

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10211.exe

Filesize
468KB

MD5
1ba129b515de7d09ee9675f7058dd12d

SHA1
80f7137e7a42115d1c093a34326d483e52ce1dba

SHA256
bfe54dda92f448ba3623dc24142d87c41c6d8b40f24b406b8270a2f980d81611

SHA512
64f95dddb6fb9e760f1d5f9512b62d802db678cd6a20c588024a68c07eccfcf5974203b9f880939bbd815b97776963a1c7b807f5f9a624463b6e910331f5e41f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19772.exe

Filesize
468KB

MD5
08ef1738e47cba6c1b391957d4f7c722

SHA1
d2f00a80bed90a02a8597674f505fa473f343b9c

SHA256
c854e8cc73b0c97c23c99b35acdacd02884cb1f556bba3ad2b6a4f1b3a3c5c3a

SHA512
a44dc2e37851d916e434edb3516c4f3431e505ef6adea1d724c304fea629be370bec91e9887596d81615c9c304a0480edb38d701d2897274e04f53571ee80855

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22108.exe

Filesize
468KB

MD5
f6ddaf015f096108b527e0087ab84299

SHA1
80f894699598a0a42a9074d7444e3b4dc70f92ba

SHA256
7d9be9c00fd962682fced15ae9958071a52e8bb7c5a8ca173c7468be4672c324

SHA512
b6bb4bd4db7d7d048e5a2a38708087c16656e334e5f3f732d88130cc35d3442503587eb84f764b5d4df7d5fce8bf000e9c89f44e188324e365183e87a20944ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22651.exe

Filesize
468KB

MD5
e9ec844c5fbf2619c3b0452338d075cd

SHA1
dc5308f723f7ec0deccc2af252fbcf3dc0f504e0

SHA256
ccd01244cdff1c30e79ea750fd1767e0ce68e5723f36673cabf0800a8d2bc8f8

SHA512
af369be71c95ee9e4008770d0c12e1cbe9a41612f2555b932e6591291e9f2c38f82b82bd03bff2c89bea07b35af12f950b3b4f7e820ef1bdf52dff35c7faa558

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe

Filesize
468KB

MD5
38a05fddc54f917ca8a4308d5f38ec67

SHA1
c5a6d8e3ace9f5389dc301c68815995852d9bc1a

SHA256
43e3af63f68e7834854f9805ebbd9fa5dfecf12770f25acb638d73928b9cd02d

SHA512
bcaf18ad4d55ba566f6d4b070a9f36197980b9c6322bcc5e284cdc7c6ff7091c762a3cc16c0bed671e7d70ba770bd338d773a0db9cad5fb96b4ce2874079d63f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2785.exe

Filesize
468KB

MD5
29cf99abc03aac908157d08c89d06922

SHA1
55b7757bacefbab84258f6005acf4daa34cf81cd

SHA256
472d66fe45f99896ad8968e17bf57f1b7ff88658620a91d4b1237f2568ed2d2f

SHA512
2be4cff911c914e1849a29564969ddb358a57e78967234d6b63d50f453d05460ec25d67ffced049c5be6703a9bf50a707c553f77e3ef5ef823a1c26ed0f02326

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28863.exe

Filesize
468KB

MD5
f132e4662eb4833d7854be9497c40d3f

SHA1
3734f0170992ea4258b123fb841edf3d05af2f34

SHA256
81cc7f6df1fc22b7353ca921f22bf271bf8b308f84abc8c3e4088c1182cd54ff

SHA512
8880f9f000ad8e0f7c5fc972f360dd3ebb0200632591c70818fa4102f58e527eb70879eb3ba17e8be4f8f0b1d703ac850ba953795b55f895537f22cf76177112

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29430.exe

Filesize
468KB

MD5
ddef42d541de71c1fd12d59e052e2932

SHA1
ee7efd6af190c50b91e9db6c136716a4e639d457

SHA256
b0dee1c49ede6773198967be4f8c68ce8480bde6d3c3f6b861bb1bd1c550cee4

SHA512
87810309dea6f916bd1ecaa81e7a9895a265dbba52cca06a33243420a45f2cd91602f87f7e96b980140dd13afb395e4f37fde1f3d227f1bb2a524c5912f380ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe

Filesize
468KB

MD5
103db95cd957776cdf486065cf48731d

SHA1
d12760c46485d4c926647b571fb42a67959ac0af

SHA256
b902f24eadd28c9ca99237abfb0493aba3b5b9f16bd5fd80c9147bed59cc3d8b

SHA512
f3399e8099ae86834e719f878ed7560199c7020d7ae8c943dabd4f8cf67a1623e6968331330ea6425ae230f7cbe81f406ea73ac7b332bbfba24e5bb808e7c913

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32927.exe

Filesize
468KB

MD5
4bc22bc19f630a1f363cc5e0a7b904df

SHA1
86c6f6d4ab65f6799855f19b734d68483c66d90d

SHA256
16492cc7cee2f9196c9c5d3d0f7a32725a60add3a5c8a4060426b5f7608a068a

SHA512
b6b05d0d942daedaea6510e0adf061c50d5e16fbb699691fd5df3e0bdc288ef592dcf4bea30dda52599ab3d72d6b20db08bf23505717ca7633410d02d772f5a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35620.exe

Filesize
468KB

MD5
55b82cc3ff30c90ec4fff1b6f6d2449d

SHA1
48187ac5a01712890bc76d5ed2edcb64ecaed535

SHA256
bf8ba0640804f4cd43a6accf36fd0fe61ad068fac551803bd9f089bfd2f458b8

SHA512
b62035a9464591e3e3038bfb92af12a6f4887d70824b9cdcee89ccbbaa79cb4f6eec0a5ee4172890ee797ef88e4575f82fd38de550a27a636bd4ea2b3f67d4a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37156.exe

Filesize
468KB

MD5
97eb4e6947e0344df0f33b9bd85d117e

SHA1
23e672be9eb239f06ca7b95ff15b368c33514907

SHA256
af4838d2b4a3d4b7c2663bfc9a5232637f71f8a29270faeff4a838a62aabc854

SHA512
85938de531485c8f1c37b8baf2e4ce2b7d5dc0923c6abcfb0ff04f180a1f48b177f8adadd366e25314b68fd8918bbcfc9685de054cd5c87e2dfa579927b57f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38491.exe

Filesize
468KB

MD5
7da61b611f5842c127b61971085bc9a6

SHA1
1e125c4a1f421e559048ef15daab70afd541583a

SHA256
3876807d52fa102cfc05d107a159d343304c5d14065667562124c6a9317b2593

SHA512
c92afb5b72005357c7d09fc74d75b17a5653a8b2d27d2d640769397963593f436490a38877fbeec223a96a2ee49055bb45eccd2c86cd9ffe0a6a5875269ba995

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe

Filesize
468KB

MD5
fa4f5d8889e5fb0bd20b497b25a5da6a

SHA1
2b5a340e2fd161ec22629cc68f852744f783792e

SHA256
9d749d5f83631b9155b61f0da169f18f9c299d2f661b8bcc726ca55c03ea4c9f

SHA512
b5efe5db01e23e522a62106c5be529c6d86bdff45ef1b00eb52ae32572622ea877fea7bd7788dcb49217a19810d321c270b61e446b45fa5a010aff311c0717b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39638.exe

Filesize
468KB

MD5
4e8a8ccb30e6b426a78005194bf77bb6

SHA1
8a39f15ccaa8d2e7db6390ab160b144008f2d0f7

SHA256
c36235de745d92cfd00a5c98ac61efc89f127c0db29fd9babe32814ccc09fa01

SHA512
52d5302dd2476741717d33f3838469fc963c57a0ae0391c35f9991c67e71a3335e89f836274e2bc8095bd2d04c4aaa6715d71e518d8f599c6581986fbac312d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42166.exe

Filesize
468KB

MD5
7fe337ab7ad890c71919e5df5450641f

SHA1
8df980c5ccee5059276d423172ca441b3cd2a3a5

SHA256
58fec33126c359e5258861bd4ffbb8225054152a7c01d5fd23df486cf254153e

SHA512
076efbc1907b3ce4bd771a1222f0b29dfd2a110bacb57507bbc70722f7d191a4207147c33a4d1ea1156aa888084fd9d270839ccd3645592c2a039e8348ce1d76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe

Filesize
468KB

MD5
b5cde2a307a9dc1f2256c2bf19cbac82

SHA1
71d97ff50de224bcb93557c38b2a7b10ce9cbe3a

SHA256
890b9a7ce769334a8c3ec932711337a462c109f1c518bfefae4d3eba815bab10

SHA512
fa6b854e1c7713525f8f1158104d0eca48c3bab5d53a6064f490e8fe6ab0bde3c1f5657c0848d56b2cd557f1f47fdf3484ecbcae73205cbef1bcb5b357026505

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43580.exe

Filesize
468KB

MD5
6a69219a3c8e2233e787b490cd53f9c1

SHA1
09f3c48967bede92007ed471aa47080cdb5b93fe

SHA256
e57b39ba301b38eb4a6abcc0fdf24522a36755c33fd3eaeea7b2ff41e76d02cf

SHA512
11d246e6a1704107a3a68247a25d81c1c9e432f8717b94f06ae698417e31c9a2604eee524a2f7c6045c6c06e8a85f34a971809bc8ab36fde38468680d02e7131

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44633.exe

Filesize
468KB

MD5
715648c8db0fabbef577a30b13d144bc

SHA1
86e49725a8dcddeebaaf634fe1af6176bd914f2d

SHA256
6deb02cdb2ad5404aa59e617a640851d29720dfc90476f08eb12c19c9541131c

SHA512
fd76fef323f005bbb0a5b09025b48d1d7e0d8dc19c2884b3865ef94b1b5d54bc881d1e4beb755bc27dd523f9d1e74f99c961bd8f703b140233ca7544c51b073c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48464.exe

Filesize
468KB

MD5
41f54c146bb2d39e312bf3068cee66f7

SHA1
e1e05edf695476883704601d89414229c8e85ded

SHA256
42afe8415f4f94cb2a1c8f26cda6d73ee060d4b280c6f8ddc365dce75abeafba

SHA512
2e9395698fc0d113901ca4d5c38a35c1b3f30a36e448b9812265e69952603f0aa90c9607acf4e881f1f24cf8351aca7de0ed3c88e6e1a36141c8ff49b7c248f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48471.exe

Filesize
468KB

MD5
3b40314aecbac8941c0e29c657d9b8de

SHA1
86bf1aad212f94a9c146392c46d2c6259b235693

SHA256
9539b4a75dd91a74d553fd11c0de287b6b1148c5a508e337397faff9f7308df2

SHA512
06cc46da1103cf6ad48e661cd20ebe339f414e22b25a8ea99783bd1f22937c5a5b882aeea22753d4ae8339b2d83d1b8c0c155aa164bb073b00504720172a177f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48729.exe

Filesize
468KB

MD5
c226ed1a29f9f607c9eae38a073305fb

SHA1
22ab2555674062fdd71871bfae1aa98b4affaed9

SHA256
3cb0289d3cf35ee26a1d52cfb650e4091438e52df8c1e36ed8a8c6ddf6897b79

SHA512
6b7742008fe27d7bea03ddae79bf0af244451ba442e7ebeb54e45f1c246079ba2b1e7ccfcb37322c67bdbd9174c2dde355bd7658fab1f932baa5e2414e67d5ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53104.exe

Filesize
468KB

MD5
c143facea99d78b5ab1e7b56502cba83

SHA1
9267db22cdb471a12000ec63a663a84d07ae9c55

SHA256
ce594574cf637a82e9b936068a830e5a03d7b5bbb3cc5711b9895e5ced97dd6f

SHA512
aa85f8b08c53230bcab74f18f1e9b5f51680503618c03aca572edbd687f4df509f14031e2f2e8fcec832aa722c92d994c9347cc6f58e695c00211a5e369700a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe

Filesize
468KB

MD5
c968d91adb48038696f1c8bc0f184cc5

SHA1
05f998d9a05b0ceefa9314e20ba0e292fc8f25c2

SHA256
e855aa2bd4f410ab4ac30ba89fb40147a87674f3995ada4941a6a90cff4b8de8

SHA512
4597a7dbdb06e5539b4503cf8757f2578754cac0d136b5f1ebe19c4fef8d0a01361245f34e447dc1af745b4ebc76c271e95d71624cc82bad9f8ed64edc47d56f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55419.exe

Filesize
468KB

MD5
efca924d923197c9790c3a4fec934fa2

SHA1
e25332c1c4b233fe0c39bb59f17dcff03e4678d5

SHA256
796d47a42a849e57f30140089cbf60c06e83737ba21fe050cdb26f3fefd81f5c

SHA512
534f17eaf31067aeca1447ec7d63c4c82cc219bb8dd7ebf0de259772665866c175d0e31a1706b76eeb3568dfb30b8cbcd771dc4093c3abd5745627d625ee7c85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe

Filesize
468KB

MD5
d08e194d6dbf9354e1fa527a2f34ac40

SHA1
af9d11af4495c98723f7e4f352c9e6ed16f992e7

SHA256
4ea869c9149f3a4650c3e311438da37313b781d87d94897d1d59b1aaededbccf

SHA512
03e1f6715f02559bf7af6f9693b087227184f88d0949584802745d0d19751c05e1c4fddf950df97fbe3969be8f97cf40350c706ff7701b20bbdf4709a66537b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62013.exe

Filesize
468KB

MD5
9f6832f26c0cabe9323ba75b4c58a2f3

SHA1
c656422355255ff28d590422794d8bde3c6d777e

SHA256
94f1bc1b0dc2e8777379daf408c73c67166ed3bfeeb38f3cd3176ba869ed3dc2

SHA512
511d6a24654f58341471a49be8adaf5ca9ff602d13e0b81111b9344dc890278dfc93c8a1e6a4514721bc92525c07764bd48b66b9c418d2218ae229ef92363c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62157.exe

Filesize
468KB

MD5
6bcc4e3898d2dc0f53a6e2bae25b6a3c

SHA1
d5c48a421a47dd13a2f06bb87faa9ce092638e5f

SHA256
e8e5582092bdc73c1ef2a32741801f9bea4a88ac7bd176d16913100f4a11c517

SHA512
fd5cebd63606d3c7c2ac14e1e6696fd36e5a5a8b7cda23b1c85a62396b8f7114407ce8aabdb6d96f4d9c3b1ffb66153964fbe782c6ccc57448724daa3017558f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63111.exe

Filesize
468KB

MD5
0033cf97e5a1bb64526c592e441b6205

SHA1
1f39f1b04b0d5700e1b70c8e88bd530b9871ded5

SHA256
dbb77d04adf0e1d7ed7df119f736cc3459c6aee8440d3a251cc86fe07fd798c3

SHA512
c2242f1f6dc7c687e0b38494d743b978f20263606534c2c0e78ac68bc2236d3eb1d7bd0573bd6beaf9014a4da7a070bd6e8cce04474d3027482fe5caa515bfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63867.exe

Filesize
468KB

MD5
7816d5cfac0233640eeae625d8757ef2

SHA1
88646f1301216d69b8426902e91123dd961fbea2

SHA256
c8e2c2744cfb9e808b4d123fd9dd2e87326eff672260ac6d899c890c94e50622

SHA512
efb2eccb7fed2b2994153121437dcd4a4b797813fe5885b9cf8197b9dcae842170e3127972971eea775769f5167f7d9643c545db6e4d3451b650f21c915eda93

Download Submit
memory/100-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/116-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/208-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/320-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/616-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/648-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/900-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1380-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1808-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2064-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2496-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2560-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3556-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3884-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4120-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4184-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4372-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4852-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5148-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5456-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-576-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-577-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-578-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5704-579-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5796-580-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-595-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5864-596-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5900-597-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6060-616-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14072-2389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads